メニュー
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1553-002-code-signingコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SKILL.md を表示中
SOC 職業分類に基づく
| name | T1553.002_code-signing |
| description | Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1553.002","defense-evasion","macos","windows","sub-technique"] |
| technique_id | T1553.002 |
| tactic | defense-evasion |
| all_tactics |
| ["defense-evasion"] |
| platforms | ["macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1553/002 |
| tech_stack | ["macos","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1553","T1553.001","T1553.003","T1553.004","T1553.005","T1553.006"] |
| prerequisites | ["T1553"] |
| severity_boost | {"T1553":"Chain with T1553 for deeper attack path","T1553.001":"Chain with T1553.001 for deeper attack path","T1553.003":"Chain with T1553.003 for deeper attack path"} |
Sub-technique of: T1553
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid signature.
Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform.
Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Platforms: macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Code Signing by examining the target platforms (macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1553.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
No specific mitigations documented for this technique.
| Finding | Severity | Impact |
|---|---|---|
| Code Signing technique applicable | Low | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |
